Hi there. I'm a newbie in ELK stack. I am trying to configure logstasth to gather data from filebeat and put it in different indices depending from sources' filenames.
Thank for the reference. Should I use [log_type=="cmslog"] instead of [fields.log_type=="cmslog"].
This config is not working too. Is my custom field on top-level. And if not, which field is on top?
Since you have fields_under_root: true you should use [log_type] == "cmslog". But there's no need to speculate; skip the conditionals and inspect what your events actually look like, then adjust your configuration to suit reality.
You have misindented your field_under_root: true line in the Filebeat configuration. It should be on the same level as the fields: lines. If you fix that fields.log_type will become plain log_type and your Logstash configuration should read if [log_type] = "..." {.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.